Correlate
Correlation FAQ
Correlate answers what is related; it does not decide what is malicious or proven.
What is an observation?
A normalized source record from endpoint, authentication, network, or cloud-storage telemetry.
What is a relationship?
A deterministic rule result connecting observations through entities, timing, or explicit event semantics.
Does it map ATT&CK?
No. ATT&CK is external knowledge owned by the investigation enrichment layer.
Are source notes used?
No. Development ATTACK annotations are removed from the production fixture and cannot influence semantic output.